CVE-2026-35450
published 2026-04-06CVE-2026-35450: WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server…
PriorityP433medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.37%
28.9th percentile
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php) require User::isAdmin().
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wwbn | avideo | <= 26.0 | — |
| wwbn | avideo | 0 – 26.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php
osv·2026-04-04
CVE-2026-35450 [MEDIUM] AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php
AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php
## Summary
The `plugin/API/check.ffmpeg.json.php` endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (`kill.ffmpeg.json.php`, `list.ffmpeg.json.php`, `ffmpeg.php`) require `User::isAdmin()`.
## Details
The entire file at `plugin/API/check.ffmpeg.json.php`:
```php
<?php
$configFile = __DIR__.'/../../videos/configuration.php';
require_once $configFile;
header('Content-Type: application/json');
$obj = testFFMPEGRemote();
die(json_encode($obj));
```
No `User::isAdmin()`, `User::isLogged()`, or any access control check exists.
Compare with sibling endpoints in the same directory:
- `kill.ffmpeg.j
GHSA
AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php
ghsa·2026-04-04
CVE-2026-35450 [MEDIUM] CWE-306 AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php
AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php
## Summary
The `plugin/API/check.ffmpeg.json.php` endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (`kill.ffmpeg.json.php`, `list.ffmpeg.json.php`, `ffmpeg.php`) require `User::isAdmin()`.
## Details
The entire file at `plugin/API/check.ffmpeg.json.php`:
```php
<?php
$configFile = __DIR__.'/../../videos/configuration.php';
require_once $configFile;
header('Content-Type: application/json');
$obj = testFFMPEGRemote();
die(json_encode($obj));
```
No `User::isAdmin()`, `User::isLogged()`, or any access control check exists.
Compare with sibling endpoints in the same directory:
- `kill.ffmpeg.j
No detection rules found.
No public exploits indexed.
2026-04-06
Published